@deadragdoll/tellymcp 0.0.13 → 0.0.14

package/dist/services/features/telegram-mcp/src/features/browser-attach/model/types.js

@@ -1,2 +1,188 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.firefoxAttachInboundMessageSchema = exports.firefoxAttachTabRecordSchema = void 0;
+const z = __importStar(require("zod/v4"));
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
+const MAX_ID_LENGTH = 256;
+const MAX_TEXT_LENGTH = 16 * 1024;
+const MAX_GENERIC_STRING_LENGTH = bodyLimits_1.MAX_BODY_SIZE_BYTES;
+const MAX_GENERIC_ARRAY_ITEMS = 4096;
+const MAX_GENERIC_OBJECT_KEYS = 512;
+const MAX_GENERIC_DEPTH = 24;
+const MAX_TABS = 4096;
+const boundedString = z.string().max(MAX_TEXT_LENGTH);
+const identifier = z.string().trim().min(1).max(MAX_ID_LENGTH);
+const tabId = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const validateBoundedJson = (value, context) => {
+    const queue = [{ value, depth: 0 }];
+    while (queue.length > 0) {
+        const current = queue.pop();
+        if (!current) {
+            break;
+        }
+        if (current.depth > MAX_GENERIC_DEPTH) {
+            context.addIssue({
+                code: "custom",
+                message: `JSON nesting exceeds ${MAX_GENERIC_DEPTH} levels`,
+            });
+            return;
+        }
+        if (typeof current.value === "string") {
+            if (current.value.length > MAX_GENERIC_STRING_LENGTH) {
+                context.addIssue({
+                    code: "too_big",
+                    origin: "string",
+                    maximum: MAX_GENERIC_STRING_LENGTH,
+                    inclusive: true,
+                    message: `String exceeds ${MAX_GENERIC_STRING_LENGTH} characters`,
+                });
+                return;
+            }
+            continue;
+        }
+        if (Array.isArray(current.value)) {
+            if (current.value.length > MAX_GENERIC_ARRAY_ITEMS) {
+                context.addIssue({
+                    code: "too_big",
+                    origin: "array",
+                    maximum: MAX_GENERIC_ARRAY_ITEMS,
+                    inclusive: true,
+                    message: `Array exceeds ${MAX_GENERIC_ARRAY_ITEMS} items`,
+                });
+                return;
+            }
+            for (const item of current.value) {
+                queue.push({ value: item, depth: current.depth + 1 });
+            }
+            continue;
+        }
+        if (current.value && typeof current.value === "object") {
+            const entries = Object.entries(current.value);
+            if (entries.length > MAX_GENERIC_OBJECT_KEYS) {
+                context.addIssue({
+                    code: "custom",
+                    message: `Object exceeds ${MAX_GENERIC_OBJECT_KEYS} keys`,
+                });
+                return;
+            }
+            for (const [, item] of entries) {
+                queue.push({ value: item, depth: current.depth + 1 });
+            }
+        }
+    }
+};
+const boundedRecord = z
+    .record(z.string().max(MAX_ID_LENGTH), z.unknown())
+    .superRefine(validateBoundedJson);
+exports.firefoxAttachTabRecordSchema = z.strictObject({
+    tab_id: tabId,
+    window_id: tabId.optional(),
+    active: z.boolean(),
+    title: boundedString,
+    url: boundedString,
+    status: z.string().max(64).optional(),
+});
+const requestId = identifier;
+exports.firefoxAttachInboundMessageSchema = z.discriminatedUnion("type", [
+    z.strictObject({
+        type: z.literal("hello"),
+        extension_version: z.string().trim().min(1).max(64),
+        browser: z.enum(["firefox", "chrome"]),
+        instance_id: identifier,
+        profile_name: z.string().max(MAX_ID_LENGTH).optional(),
+    }),
+    z.strictObject({
+        type: z.literal("heartbeat"),
+        sent_at: z.string().min(1).max(64),
+    }),
+    z.strictObject({
+        type: z.literal("list_tabs_result"),
+        request_id: requestId,
+        tabs: z.array(exports.firefoxAttachTabRecordSchema).max(MAX_TABS),
+    }),
+    z.strictObject({
+        type: z.literal("get_active_tab_result"),
+        request_id: requestId,
+        tab: exports.firefoxAttachTabRecordSchema.nullable(),
+    }),
+    z.strictObject({
+        type: z.literal("active_tab_changed"),
+        tab: exports.firefoxAttachTabRecordSchema,
+    }),
+    z.strictObject({
+        type: z.literal("tab_updated"),
+        tab: exports.firefoxAttachTabRecordSchema,
+    }),
+    z.strictObject({
+        type: z.literal("attach_tab_selected"),
+        tab: exports.firefoxAttachTabRecordSchema,
+    }),
+    z.strictObject({
+        type: z.literal("tab_action_result"),
+        request_id: requestId,
+        ok: z.boolean(),
+        result: boundedRecord.optional(),
+        error: boundedString.optional(),
+    }),
+    z.strictObject({
+        type: z.literal("recording_control_result"),
+        request_id: requestId,
+        ok: z.boolean(),
+        active: z.boolean(),
+        error: boundedString.optional(),
+    }),
+    z.strictObject({
+        type: z.literal("recording_event"),
+        recording_id: identifier,
+        tab_id: tabId,
+        event: boundedRecord,
+    }),
+    z.strictObject({
+        type: z.literal("recording_manual_start"),
+        request_id: requestId,
+        tab: exports.firefoxAttachTabRecordSchema.optional(),
+    }),
+    z.strictObject({
+        type: z.literal("recording_manual_stop"),
+        request_id: requestId,
+        tab: exports.firefoxAttachTabRecordSchema.optional(),
+    }),
+    z.strictObject({
+        type: z.literal("recording_manual_status"),
+        request_id: requestId,
+        tab: exports.firefoxAttachTabRecordSchema.optional(),
+    }),
+]);

package/dist/services/features/telegram-mcp/src/features/collaboration/model/collaborationService.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CollaborationService = void 0;
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
 class CollaborationService {
     backend;
     logger;
@@ -11,6 +12,7 @@ class CollaborationService {
         this.projectIdentityResolver = projectIdentityResolver;
     }
     async sendPartnerNote(input) {
+        (0, bodyLimits_1.assertSerializedBodySize)(input);
         const resolved = this.projectIdentityResolver.resolveSessionDefaults(input);
         const output = await this.backend.sendPartnerNote(input, resolved);
         this.logger.info("Partner note processed by collaboration service", {

package/dist/services/features/telegram-mcp/src/features/collaboration/model/sendPartnerFileService.js

@@ -7,6 +7,7 @@ exports.SendPartnerFileService = void 0;
 const node_path_1 = __importDefault(require("node:path"));
 const mime_types_1 = require("mime-types");
 const client_1 = require("../../../shared/integrations/terminal/client");
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
 function resolveWorkspaceDir(input) {
     if (input.inputCwd?.trim()) {
         return node_path_1.default.resolve(input.inputCwd.trim());
@@ -69,10 +70,10 @@ class SendPartnerFileService {
             resolvedCwd: resolved.cwd,
         });
         const relativeFilePath = normalizeWorkspaceRelativePath(workspaceDir, input.file_path);
-        const fileContent = await (0, client_1.readWorkspaceFile)(this.config.terminal, workspaceDir, relativeFilePath);
+        const fileContent = await (0, client_1.readWorkspaceFile)(this.config.terminal, workspaceDir, relativeFilePath, bodyLimits_1.MAX_BASE64_SOURCE_SIZE_BYTES);
         const originalName = node_path_1.default.basename(relativeFilePath);
         const mimeType = (0, mime_types_1.lookup)(originalName) || "application/octet-stream";
-        const output = await this.collaborationService.sendPartnerNote({
+        const note = {
             session_id: sessionId,
             ...(input.target_session_id?.trim()
                 ? { target_session_id: input.target_session_id.trim() }
@@ -108,7 +109,9 @@ class SendPartnerFileService {
                     content_base64: Buffer.from(fileContent).toString("base64"),
                 },
             ],
-        });
+        };
+        (0, bodyLimits_1.assertSerializedBodySize)(note);
+        const output = await this.collaborationService.sendPartnerNote(note);
         this.logger.info("Partner file sent through send_partner_file", {
             sessionId: output.session_id,
             partnerSessionId: output.partner_session_id,

package/dist/services/features/telegram-mcp/src/features/distributed-client/model/gatewayClientAccess.js

@@ -7,6 +7,7 @@ exports.normalizeGatewayBaseUrl = normalizeGatewayBaseUrl;
 exports.callGatewayJson = callGatewayJson;
 exports.ensureGatewayClientUuid = ensureGatewayClientUuid;
 const node_os_1 = __importDefault(require("node:os"));
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
 function normalizeGatewayBaseUrl(value) {
     const url = new URL(value);
     url.pathname = url.pathname.replace(/\/+$/u, "");
@@ -18,6 +19,8 @@ function normalizeGatewayBaseUrl(value) {
 async function callGatewayJson(input) {
     const url = normalizeGatewayBaseUrl(input.gatewayPublicUrl);
     url.pathname = `${url.pathname}${input.endpointPath}`.replace(/\/{2,}/gu, "/");
+    const serializedBody = JSON.stringify(input.body);
+    (0, bodyLimits_1.assertStringBodySize)(serializedBody);
     const response = await fetch(url, {
         method: "POST",
         headers: {
@@ -26,7 +29,7 @@ async function callGatewayJson(input) {
                 ? { authorization: `Bearer ${input.gatewayAuthToken}` }
                 : {}),
         },
-        body: JSON.stringify(input.body),
+        body: serializedBody,
     });
     if (!response.ok) {
         const message = await response.text();

package/dist/services/features/telegram-mcp/src/features/distributed-gateway/model/gatewayHttpService.js

@@ -5,6 +5,8 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const schema_1 = require("../../../entities/request/model/schema");
 const relay_1 = require("../../../app/webapp/relay");
+const gatewayAuth_1 = require("../../../shared/lib/gatewayAuth");
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
 const versionHandshake_1 = require("../../../shared/lib/version/versionHandshake");
 function readHeader(req, headerName) {
     const value = req.headers[headerName];
@@ -73,9 +75,6 @@ function normalizeLiveRelayBootstrapResult(response) {
         session_id: sessionId,
         session_label: typeof record.session_label === "string" ? record.session_label : null,
         terminal_target: record.terminal_target === true,
-        poll_interval_ms: typeof record.poll_interval_ms === "number" && record.poll_interval_ms > 0
-            ? record.poll_interval_ms
-            : 2000,
         telegram_user_id: telegramUserId,
     };
 }
@@ -145,21 +144,6 @@ class GatewayHttpService {
         }
         return response;
     }
-    async requestLiveRelayView(input) {
-        const rawResponse = await this.callBroker("telegramMcp.gatewaySocket.requestLiveRelay", {
-            clientUuid: input.clientUuid,
-            localSessionId: input.localSessionId,
-            requestType: "view",
-            payload: {},
-        }, { meta: { internal_call: true } });
-        const response = unwrapLiveRelayResult(rawResponse);
-        if (!response ||
-            typeof response !== "object" ||
-            typeof response.content !== "string") {
-            throw new Error("Invalid live relay view response");
-        }
-        return response;
-    }
     async requestLiveRelayAction(input) {
         const rawResponse = await this.callBroker("telegramMcp.gatewaySocket.requestLiveRelay", {
             clientUuid: input.clientUuid,
@@ -179,11 +163,8 @@ class GatewayHttpService {
         return response;
     }
     isAuthorized(req) {
-        if (!this.config.distributed.gatewayAuthToken) {
-            return true;
-        }
         const authorization = readHeader(req, "authorization");
-        return authorization === `Bearer ${this.config.distributed.gatewayAuthToken}`;
+        return (0, gatewayAuth_1.isGatewayAuthorizationValid)(authorization, this.config.distributed.gatewayAuthToken);
     }
     extractActionErrorMessage(value, fallback) {
         if (value && typeof value === "object") {
@@ -223,8 +204,14 @@ class GatewayHttpService {
         };
     }
     async readJsonBody(req) {
-        const knownBody = req.body;
+        const cachedRequest = req;
+        if (cachedRequest.limitedJsonBodyRead) {
+            return cachedRequest.body;
+        }
+        const knownBody = cachedRequest.body;
         if (knownBody !== undefined) {
+            (0, bodyLimits_1.assertSerializedBodySize)(knownBody);
+            cachedRequest.limitedJsonBodyRead = true;
             return knownBody;
         }
         const knownParams = req.$params;
@@ -234,20 +221,15 @@ class GatewayHttpService {
                 "summary" in knownParams ||
                 "message" in knownParams ||
                 "session_id" in knownParams)) {
+            (0, bodyLimits_1.assertSerializedBodySize)(knownParams);
+            cachedRequest.body = knownParams;
+            cachedRequest.limitedJsonBodyRead = true;
             return knownParams;
         }
-        const chunks = [];
-        for await (const chunk of req) {
-            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-        }
-        if (chunks.length === 0) {
-            return undefined;
-        }
-        const raw = Buffer.concat(chunks).toString("utf8").trim();
-        if (!raw) {
-            return undefined;
-        }
-        return JSON.parse(raw);
+        const parsedBody = await (0, bodyLimits_1.readLimitedJsonBody)(req);
+        cachedRequest.body = parsedBody;
+        cachedRequest.limitedJsonBodyRead = true;
+        return parsedBody;
     }
     async handleRequest(req, res, pathname) {
         if (!this.isEnabled() || !this.matches(pathname)) {
@@ -290,6 +272,22 @@ class GatewayHttpService {
                 return true;
             }
         }
+        if (["POST", "PUT", "PATCH", "DELETE"].includes(req.method ?? "")) {
+            try {
+                await this.readJsonBody(req);
+            }
+            catch (error) {
+                if ((0, bodyLimits_1.isBodySizeLimitError)(error)) {
+                    writeJson(res, 413, {
+                        error: `Request body exceeds the ${bodyLimits_1.MAX_BODY_SIZE} MiB limit`,
+                    });
+                }
+                else {
+                    writeJson(res, 400, { error: "Invalid JSON request body" });
+                }
+                return true;
+            }
+        }
         if (pathname === "/gateway/partner-note") {
             if (req.method !== "POST") {
                 writeText(res, 405, "Method not allowed");

package/dist/services/features/telegram-mcp/src/features/file-content/model/getFileListTool.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetFileListTool = void 0;
+const schema_1 = require("../../../entities/request/model/schema");
+function createContent(output) {
+    return [
+        {
+            type: "text",
+            text: JSON.stringify(output, null, 2),
+        },
+    ];
+}
+class GetFileListTool {
+    getFileService;
+    constructor(getFileService) {
+        this.getFileService = getFileService;
+    }
+    register(server) {
+        server.registerTool("get_file_list", {
+            title: "Get File List",
+            description: "List managed files available in the workspace of a selected live console before calling get_file. Returns exact file_path values for Telegram uploads, browser screenshots, and partner artifacts, newest first. In gateway mode, pass session_id exactly as returned by list_gateway_sessions. Optionally filter by source and limit the result count.",
+            inputSchema: schema_1.getFileListInputSchema,
+            outputSchema: schema_1.getFileListOutputSchema,
+        }, async (args) => {
+            const output = await this.getFileService.list(args);
+            return {
+                content: createContent(output),
+                structuredContent: output,
+            };
+        });
+    }
+}
+exports.GetFileListTool = GetFileListTool;